Comparison
Plan and applyvsResource replacement
Plan and apply
the tool prints exactly what it will create, change and destroy, and you read the destroy list before typing yes.
The two-phase model of declarative infrastructure tooling: compute the difference between desired and recorded state and show it, then execute it. The plan is the single most valuable safety feature in the category, and reviewing it — particularly the replacements and deletions — is the actual control. A plan is only as good as its freshness, since anything that changes between planning and applying is not in it.
Full entry →Resource replacement
you changed one field the API cannot update in place, and the plan quietly says destroy then create.
The tool deciding a change can only be made by deleting and recreating a resource, because the underlying API has no in-place update for that attribute. On a stateless resource it is invisible; on a database, a volume or anything holding an address it is an outage or a data loss. The line to look for in a plan is the one saying the change forces replacement, and it is why plans should be read from the bottom of the risk order upwards.
Full entry →